MITRE ATT&CK Enterprise techniques whose primary tactic is Lateral Movement: detection with open-source tooling and cyber range exercises.
Detecting T1021 Remote Services on Linux, macOS, Windows and IaaS and other platforms, using telemetry such as Process Creation, Logon Session Creation and Network Connection Creation. Covers its 8 sub-techniques, the ATT&CK mitigations Disable or Remove Feature or Program and Audit, and how to rehearse the detection in a cyber range.
Detecting T1080 Taint Shared Content on Windows, SaaS, Linux and macOS and other platforms, using telemetry such as File Creation, Network Share Access and File Modification. Covers the ATT&CK mitigations Exploit Protection and Restrict File and Directory Permissions and how to rehearse the detection in a cyber range.
Detecting T1091 Replication Through Removable Media on Windows, using telemetry such as Process Creation, File Creation and File Access. Covers the ATT&CK mitigations Disable or Remove Feature or Program and Behavior Prevention on Endpoint and how to rehearse the detection in a cyber range.
Detecting T1210 Exploitation of Remote Services on Linux, Windows, macOS and ESXi, using telemetry such as Process Creation, Network Traffic Content and Network Connection Creation. Covers the ATT&CK mitigations Disable or Remove Feature or Program and Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1534 Internal Spearphishing on Linux, macOS, Office Suite and SaaS and other platforms, using telemetry such as Process Creation, Network Traffic Content and Logon Session Creation. Covers how to rehearse the detection in a cyber range.
Detecting T1550 Use Alternate Authentication Material on Containers, IaaS, Identity Provider and Linux and other platforms, using telemetry such as Process Creation, Logon Session Creation and Application Log Content. Covers its 4 sub-techniques, the ATT&CK mitigations Privileged Account Management and Audit, and how to rehearse the detection in a cyber range.
Detecting T1563 Remote Service Session Hijacking on Linux, macOS and Windows, using telemetry such as Process Creation, Network Traffic Content and Logon Session Creation. Covers its 2 sub-techniques, the ATT&CK mitigations Disable or Remove Feature or Program and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1570 Lateral Tool Transfer on ESXi, Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and File Creation. Covers the ATT&CK mitigations Filter Network Traffic and Network Intrusion Prevention and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.